@fleetbase/fleetops-engine 0.6.69 → 0.6.71

package/server/tests/Feature/Http/Api/TelematicsRetentionIndexMigrationTest.php

@@ -0,0 +1,115 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The retention sweep ranges over (company_uuid, created_at) and
+ * (telematic_uuid, updated_at); these migrations add those indexes once,
+ * skip equivalent existing ones, and roll back only what they created.
+ */
+function fleetopsRetentionIndexDatabase(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'), ':memory:', '', ['driver' => 'sqlite']);
+    Schema::swap($connection->getSchemaBuilder());
+
+    return $connection;
+}
+
+function fleetopsRetentionIndexMigrations(): array
+{
+    $migrations = [];
+    foreach (glob(dirname(__DIR__, 4) . '/migrations/2026_09_23_00000*_add_retention_index_to_*.php') as $path) {
+        $migrations[basename($path)] = fn () => require $path;
+    }
+
+    return $migrations;
+}
+
+test('retention index migrations add composite indexes once and roll them back', function () {
+    fleetopsRetentionIndexDatabase();
+    Schema::create('device_events', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+    });
+    Schema::create('positions', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+    });
+    Schema::create('telematic_sync_runs', function ($table) {
+        $table->uuid('uuid')->primary();
+        $table->uuid('telematic_uuid')->index();
+        $table->timestamps();
+    });
+
+    $expected = [
+        'device_events'       => ['device_events_company_created_at_index', ['company_uuid', 'created_at']],
+        'positions'           => ['positions_company_created_at_index', ['company_uuid', 'created_at']],
+        'telematic_sync_runs' => ['telematic_sync_runs_telematic_updated_at_index', ['telematic_uuid', 'updated_at']],
+    ];
+    $migrations = fleetopsRetentionIndexMigrations();
+    expect($migrations)->toHaveCount(3);
+    foreach ($migrations as $load) {
+        $load()->up();
+        $load()->up();
+    }
+    foreach ($expected as $table => [$name, $columns]) {
+        expect(TableIndexes::for($table)[$name] ?? null)->toBe($columns)
+            ->and(TableIndexes::covers($table, $columns))->toBeTrue()
+            ->and(TableIndexes::covers($table, ['created_at']))->toBeFalse();
+    }
+    // The existing single-column index on telematic_uuid does not cover the composite.
+    expect(count(array_filter(TableIndexes::for('telematic_sync_runs'), fn ($columns) => $columns === ['telematic_uuid'])))->toBe(1);
+
+    foreach ($migrations as $load) {
+        $load()->down();
+    }
+    foreach ($expected as $table => [$name]) {
+        expect(TableIndexes::for($table))->not->toHaveKey($name);
+    }
+});
+
+test('retention index migrations skip missing tables, missing columns and equivalent indexes', function () {
+    fleetopsRetentionIndexDatabase();
+    $migrations = fleetopsRetentionIndexMigrations();
+
+    // No tables at all: nothing to do either way.
+    foreach ($migrations as $load) {
+        $load()->up();
+        $load()->down();
+    }
+
+    Schema::create('device_events', fn ($table) => $table->increments('id'));
+    Schema::create('positions', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+        $table->index(['company_uuid', 'created_at', 'id'], 'positions_existing_company_created');
+    });
+    Schema::create('telematic_sync_runs', function ($table) {
+        $table->uuid('uuid')->primary();
+        $table->uuid('telematic_uuid');
+        $table->timestamps();
+        $table->index(['telematic_uuid', 'updated_at'], 'telematic_sync_runs_telematic_updated_at_index');
+    });
+    Schema::table('telematic_sync_runs', fn ($table) => $table->index('updated_at', 'unrelated_updated_at'));
+
+    foreach ($migrations as $load) {
+        $load()->up();
+    }
+    expect(TableIndexes::for('device_events'))->toBe([])
+        ->and(array_keys(TableIndexes::for('positions')))->toBe(['positions_existing_company_created'])
+        ->and(TableIndexes::for('telematic_sync_runs'))->toHaveKeys(['telematic_sync_runs_telematic_updated_at_index', 'unrelated_updated_at']);
+
+    // Rolling back never drops an index the migration did not create, even under the reserved name when its shape differs.
+    Schema::table('telematic_sync_runs', fn ($table) => $table->dropIndex('telematic_sync_runs_telematic_updated_at_index'));
+    Schema::table('telematic_sync_runs', fn ($table) => $table->index('updated_at', 'telematic_sync_runs_telematic_updated_at_index'));
+    foreach ($migrations as $load) {
+        $load()->down();
+    }
+    expect(array_keys(TableIndexes::for('positions')))->toBe(['positions_existing_company_created'])
+        ->and(TableIndexes::for('telematic_sync_runs')['telematic_sync_runs_telematic_updated_at_index'])->toBe(['updated_at']);
+});

package/server/tests/Feature/Http/Internal/OrderControllerActivityFlowsTest.php

@@ -661,3 +661,75 @@ test('set destination and next activity guard missing orders and configs', funct
     $noConfig = $controller->nextActivity('order_internal', Request::create('/x', 'GET'));
     expect($noConfig->getData(true)['error'] ?? '')->toBe('No order config found for order.');
 });
+
+function fleetopsInternalActivityUseLifecycle(SQLiteConnection $connection, array $lifecycle = []): void
+{
+    $activity = fn (string $code, array $children = []) => ['key' => $code, 'code' => $code, 'status' => ucfirst($code), 'details' => ucfirst($code) . ' loan', 'activities' => $children, 'logic' => [], 'events' => [], 'complete' => $code === 'completed'];
+
+    $connection->table('order_configs')->where('uuid', 'config-1')->update([
+        'flow' => json_encode([
+            'requested' => $activity('requested', ['assigned', 'cancelled']),
+            'assigned'  => $activity('assigned', ['completed']),
+            'completed' => $activity('completed'),
+            'cancelled' => $activity('cancelled'),
+        ]),
+        'meta' => json_encode(['lifecycle' => array_replace([
+            'initial'            => 'requested',
+            'completed'          => 'completed',
+            'canceled'           => 'cancelled',
+            'dispatch'           => false,
+            'strict_transitions' => true,
+        ], $lifecycle)]),
+    ]);
+}
+
+test('strict transitions reject activities outside the configured flow and use the configured definition', function () {
+    $connection = fleetopsInternalActivityBoot();
+    $controller = new OrderController();
+
+    fleetopsInternalActivityUseLifecycle($connection);
+    fleetopsInternalActivitySeedOrder($connection, ['status' => 'requested']);
+
+    // Not a child of the current activity
+    $skipped = $controller->updateActivity('order_internal', Request::create('/x', 'POST', ['activity' => ['key' => 'completed', 'code' => 'completed', 'status' => 'Completed'], 'bypass_proof' => 1]));
+    expect($skipped->getStatusCode())->toBe(422)
+        ->and($skipped->getData(true)['error'])->toContain('not a permitted next step');
+
+    // Not in the flow at all
+    $unknown = $controller->updateActivity('order_internal', Request::create('/x', 'POST', ['activity' => ['key' => 'started', 'code' => 'started', 'status' => 'Started'], 'bypass_proof' => 1]));
+    expect($unknown->getStatusCode())->toBe(422);
+
+    // A configured child is accepted, with the server-side definition replacing the client's
+    $assigned = $controller->updateActivity('order_internal', Request::create('/x', 'POST', ['activity' => ['key' => 'assigned', 'code' => 'assigned', 'status' => 'Tampered'], 'bypass_proof' => 1]));
+    expect($assigned)->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\Order::class)
+        ->and($connection->table('tracking_statuses')->where('code', 'ASSIGNED')->value('status'))->toBe('Assigned');
+});
+
+test('dispatch order refuses orders whose lifecycle disables dispatch', function () {
+    $connection = fleetopsInternalActivityBoot();
+    $controller = new OrderController();
+
+    fleetopsInternalActivityUseLifecycle($connection);
+    fleetopsInternalActivitySeedOrder($connection, ['status' => 'requested', 'driver_assigned_uuid' => 'driver-1']);
+
+    $response = $controller->dispatchOrder(Request::create('/x', 'POST', ['order' => 'order_internal']));
+    expect($response->getData(true)['error'] ?? '')->toContain('not dispatched')
+        ->and($connection->table('orders')->value('dispatched'))->toBe(0);
+});
+
+test('orders with a configured lifecycle start their tracking at the initial activity', function () {
+    $connection = fleetopsInternalActivityBoot();
+
+    // No config, or a config without a lifecycle, keeps the default created status
+    expect((new Fleetbase\FleetOps\Models\Order())->getInitialTrackingStatus())->toBeNull();
+    $order                    = new Fleetbase\FleetOps\Models\Order();
+    $order->order_config_uuid = 'config-1';
+    expect($order->getInitialTrackingStatus())->toBeNull();
+
+    fleetopsInternalActivityUseLifecycle($connection);
+    expect($order->getInitialTrackingStatus())->toBe(['code' => 'requested', 'status' => 'Requested', 'details' => 'Requested loan']);
+
+    // An initial activity missing from the flow falls back to the default
+    fleetopsInternalActivityUseLifecycle($connection, ['initial' => 'nowhere']);
+    expect($order->getInitialTrackingStatus())->toBeNull();
+});

package/server/tests/Feature/Http/Internal/OrderControllerCreateRecordTest.php

@@ -486,3 +486,29 @@ test('create record dispatches orders when the dispatch flag is not disabled', f
     expect($result)->toBeArray()->toHaveKey('order')
         ->and($connection->table('orders')->value('dispatched'))->not->toBeNull();
 });
+
+test('create record starts configured lifecycles at their initial activity and never dispatches them', function () {
+    $connection = fleetopsInternalOrderCreateBoot();
+    $connection->table('order_configs')->where('uuid', 'config-1')->update([
+        'flow' => json_encode([
+            'requested' => ['key' => 'requested', 'code' => 'requested', 'status' => 'Requested', 'details' => 'Loan requested', 'activities' => ['completed']],
+            'completed' => ['key' => 'completed', 'code' => 'completed', 'status' => 'Completed', 'details' => 'Loan completed', 'activities' => []],
+        ]),
+        'meta' => json_encode(['lifecycle' => ['initial' => 'requested', 'completed' => 'completed', 'dispatch' => false]]),
+    ]);
+
+    // Asks to be dispatched; the lifecycle overrides both the status and the dispatch flag
+    $result = (new OrderController())->createRecord(Request::create('/int/v1/orders', 'POST', [
+        'order' => [
+            'status'     => 'created',
+            'dispatched' => true,
+            'adhoc'      => true,
+            'payload'    => ['type' => 'transport'],
+        ],
+    ]));
+
+    expect($result)->toBeArray()->toHaveKey('order')
+        ->and($connection->table('orders')->value('status'))->toBe('requested')
+        ->and((bool) $connection->table('orders')->value('dispatched'))->toBeFalse()
+        ->and((bool) $connection->table('orders')->value('adhoc'))->toBeFalse();
+});

package/server/tests/Feature/Http/Internal/SettingControllerHelpersTest.php

@@ -131,3 +131,74 @@ test('setting helpers read notification and tracking registries', function () {
         ->and($helper('notificationsByPackage', 'fleet-ops'))->toBeArray()
         ->and($helper('trackingProviders'))->toBeArray();
 });
+
+test('history policy reconciliation clamps every organization and preserves inherited and internal settings', function () {
+    $connection = fleetopsSettingHelpersBoot();
+    $key        = Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy::SETTING_KEY;
+    $controller = new class extends SettingController {
+        public ?Closure $beforeLock = null;
+
+        public function reconcile(array $defaults): void
+        {
+            $this->reconcileTelematicsCompanyPreferences($defaults);
+        }
+
+        public function lock(Closure $callback): mixed
+        {
+            return parent::withTelematicsPolicyLock($callback);
+        }
+
+        protected function withTelematicsPolicyLock(Closure $callback): mixed
+        {
+            if ($this->beforeLock) {
+                ($this->beforeLock)();
+                $this->beforeLock = null;
+            }
+
+            return parent::withTelematicsPolicyLock($callback);
+        }
+
+        protected function telematicsDefaults(): array
+        {
+            return ['max_event_retention_days' => 90, 'max_position_retention_days' => 360];
+        }
+    };
+    // The first write creates the lock anchor; subsequent writes reuse it.
+    expect($controller->lock(fn () => 'saved'))->toBe('saved');
+    expect($controller->lock(fn () => $connection->transactionLevel()))->toBe(1)
+        ->and($connection->table('settings')->where('key', $key)->count())->toBe(1);
+    foreach ([
+        'a' => ['event_retention_days' => 0, 'position_retention_days' => 900, 'log_telemetry_activity' => true],
+        'b' => ['event_retention_days' => 30],
+        'c' => [],
+    ] as $company => $preferences) {
+        $connection->table('settings')->insert(['key' => "company.$company.$key", 'value' => json_encode($preferences)]);
+    }
+    $controller->reconcile(['max_event_retention_days' => 0, 'max_position_retention_days' => 0]);
+    $read = fn ($company) => json_decode($connection->table('settings')->where('key', "company.$company.$key")->value('value'), true);
+    expect($read('a')['event_retention_days'])->toBe(0);
+    $controller->reconcile(['max_event_retention_days' => 90, 'max_position_retention_days' => 360]);
+    expect($read('a'))->toBe(['event_retention_days' => 90, 'position_retention_days' => 360, 'log_telemetry_activity' => true])
+        ->and($read('b'))->toBe(['event_retention_days' => 30])->and($read('c'))->toBe([]);
+    // A tenant removed after the batch is read must not be recreated.
+    $controller->beforeLock = fn () => $connection->table('settings')->where('key', "company.a.$key")->delete();
+    $controller->reconcile(['max_event_retention_days' => 90]);
+    expect($connection->table('settings')->where('key', "company.a.$key")->exists())->toBeFalse();
+});
+
+test('company order configuration keys exclude other tenants and deleted configurations', function () {
+    $connection = fleetopsSettingHelpersBoot();
+    $connection->getSchemaBuilder()->create('order_configs', function ($table) {
+        $table->increments('id');
+        $table->string('uuid');
+        $table->string('public_id')->nullable();
+        $table->string('company_uuid');
+        $table->softDeletes();
+    });
+    $connection->table('order_configs')->insert([
+        ['uuid' => 'own', 'public_id' => 'own-public', 'company_uuid' => 'company-1', 'deleted_at' => null],
+        ['uuid' => 'other', 'public_id' => 'other-public', 'company_uuid' => 'company-2', 'deleted_at' => null],
+        ['uuid' => 'deleted', 'public_id' => null, 'company_uuid' => 'company-1', 'deleted_at' => '2026-01-01'],
+    ]);
+    expect((new ReflectionMethod(SettingController::class, 'companyOrderConfigKeys'))->invoke(new SettingController()))->toBe(['own', 'own-public']);
+});

package/server/tests/Feature/Http/Internal/TelematicsStorageDeadlinesTest.php

@@ -0,0 +1,119 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\SettingController;
+use Illuminate\Database\MySqlConnection;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
+
+class FleetOpsStorageDeadlineConnection extends MySqlConnection
+{
+    public array $queries   = [];
+    public array $responses = [];
+    public bool $maria      = false;
+
+    public function getReadPdo()
+    {
+        return new class($this->maria) extends PDO {
+            public function __construct(private bool $maria)
+            {
+            }
+
+            public function getAttribute(int $attribute): mixed
+            {
+                if ($attribute !== PDO::ATTR_SERVER_VERSION) {
+                    throw new LogicException('Only the database server version should be read');
+                }
+
+                return $this->maria ? '10.11.8-MariaDB' : '8.0.40';
+            }
+        };
+    }
+
+    public function select($query, $bindings = [], $useReadPdo = true)
+    {
+        $this->queries[] = [$query, $bindings];
+        $response        = array_shift($this->responses) ?? [];
+        if ($response instanceof Throwable) {
+            throw $response;
+        }
+
+        return $response;
+    }
+}
+
+function fleetopsStorageQueryError(int $code): QueryException
+{
+    $error            = new PDOException('Database query failed');
+    $error->errorInfo = ['HY000', $code, 'Database query failed'];
+
+    return new QueryException('mysql', 'select history', [], $error);
+}
+
+beforeEach(function () {
+    $this->originalDb = app()->bound('db') ? app('db') : null;
+    $this->connection = new FleetOpsStorageDeadlineConnection(new PDO('sqlite::memory:'), '', '', ['driver' => 'mysql']);
+    $connection       = $this->connection;
+    app()->instance('db', new class($connection) {
+        public function __construct(public $database)
+        {
+        }
+
+        public function connection($name = null)
+        {
+            return $this->database;
+        }
+
+        public function __call($method, $args)
+        {
+            return $this->database->{$method}(...$args);
+        }
+    });
+    DB::clearResolvedInstance('db');
+    $this->controller = new SettingController();
+    $this->invoke     = fn ($method, ...$arguments) => (new ReflectionMethod(SettingController::class, $method))->invoke($this->controller, ...$arguments);
+    $this->scope      = fn ($query) => $query->where('company_uuid', 'company-a');
+});
+
+afterEach(function () {
+    if ($this->originalDb) {
+        app()->instance('db', $this->originalDb);
+    } else {
+        app()->forgetInstance('db');
+    }
+    DB::clearResolvedInstance('db');
+});
+
+test('storage scans enforce driver specific deadlines while preserving bindings', function (bool $maria) {
+    $this->connection->maria     = $maria;
+    $this->connection->responses = [[(object) ['row_count' => '4', 'oldest' => '2026-01-01']], [(object) ['rows' => 4]]];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => 4, 'oldest' => '2026-01-01']);
+    ($this->invoke)('storageUsageSelect', 'select * from device_events where company_uuid = ?', ['company-a'], true);
+    expect($this->connection->queries[0][1])->toBe(['company-a'])
+        ->and($this->connection->queries[0][0])->toStartWith($maria ? 'SET STATEMENT max_statement_time=1 FOR select' : 'SELECT /*+ MAX_EXECUTION_TIME(1000) */')
+        ->and($this->connection->queries[1][0])->toStartWith($maria ? 'SET STATEMENT max_statement_time=1 FOR EXPLAIN select' : 'EXPLAIN SELECT /*+ MAX_EXECUTION_TIME(1000) */')
+        ->and($this->connection->queries[1][1])->toBe(['company-a']);
+})->with([false, true]);
+
+test('timed out counts use a scoped query plan estimate instead of another history scan', function () {
+    $this->connection->responses = [fleetopsStorageQueryError(3024), [(object) ['rows' => 101, 'filtered' => 25]]];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => 25, 'oldest' => null, 'rows_estimated' => true])
+        ->and($this->connection->queries[1][0])->toStartWith('EXPLAIN SELECT')
+        ->and($this->connection->queries[1][1])->toBe(['company-a']);
+    $this->connection->responses = [fleetopsStorageQueryError(1969), fleetopsStorageQueryError(1969)];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => null, 'oldest' => null, 'rows_estimated' => true]);
+});
+
+test('storage queries suppress only timeout errors and retain real database failures', function () {
+    foreach (['tableUsage', 'tableOldest'] as $method) {
+        $this->connection->responses = [fleetopsStorageQueryError(1146)];
+        expect(fn () => ($this->invoke)($method, 'device_events', $this->scope, 'created_at'))->toThrow(QueryException::class);
+    }
+    $this->connection->responses = [fleetopsStorageQueryError(3024), fleetopsStorageQueryError(1146)];
+    expect(fn () => ($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toThrow(QueryException::class);
+    $this->connection->responses = [fleetopsStorageQueryError(3024)];
+    expect(($this->invoke)('tableOldest', 'device_events', $this->scope, 'created_at'))->toBeNull();
+    $this->connection->responses = [fleetopsStorageQueryError(1969)];
+    expect(($this->invoke)('storageTableStatistics', ['device_events']))->toBe([]);
+    $this->connection->responses = [fleetopsStorageQueryError(1146)];
+    expect(fn () => ($this->invoke)('storageTableStatistics', ['device_events']))->toThrow(QueryException::class);
+});

package/server/tests/InternalImportExportControllerContractsTest.php

@@ -269,14 +269,11 @@ test('internal fuel report controller syncs custom fields after save when provid
     $controller = new FleetOpsInternalFuelReportControllerProbe();
     $fuelReport = new FleetOpsInternalFuelReportAfterSaveFake();
 
-    $controller->afterSave(new Request([
-        'fuel_report' => [
-            'custom_field_values' => [
-                ['key' => 'receipt_number', 'value' => 'R-100'],
-            ],
-        ],
-    ]), $fuelReport);
-    $controller->afterSave(new Request(['fuel_report' => ['custom_field_values' => []]]), $fuelReport);
+    $input = ['custom_field_values' => [['key' => 'receipt_number', 'value' => 'R-100']]];
+    $controller->afterSave(new Request(['fuelReport' => $input]), $fuelReport, $input);
+    $controller->afterSave(new Request(), $fuelReport, ['custom_field_values' => []]);
+    $controller->afterSave(new Request(), $fuelReport, ['custom_field_values' => 'invalid']);
+    $controller->afterSave(new Request(), $fuelReport);
 
     expect($fuelReport->synced)->toBe([
         [

package/server/tests/NavigatorControllerContractsTest.php

@@ -137,17 +137,24 @@ function fleetopsNavigatorCredential(string $key = 'flb_live_key'): ApiCredentia
     return $credential;
 }
 
+function fleetopsNavigatorSignedQuery(): array
+{
+    $expires = time() + 600;
+
+    return ['expires' => $expires, 'signature' => NavigatorController::linkSignature($expires)];
+}
+
 test('navigator controller builds android and ios app link redirects', function () {
     $company                   = fleetopsNavigatorCompany();
     $controller                = new FleetOpsNavigatorControllerProbe();
     $controller->adminUser     = fleetopsNavigatorUser($company);
     $controller->apiCredential = fleetopsNavigatorCredential('flb_live_navigator');
 
-    $android = $controller->linkApp(Request::create('/navigator/link-app', 'GET', [], [], [], [
+    $android = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery(), [], [], [
         'HTTP_USER_AGENT' => 'Mozilla/5.0 Android',
     ]))->getData(true);
 
-    $ios = $controller->linkApp(Request::create('/navigator/link-app', 'GET', [], [], [], [
+    $ios = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery(), [], [], [
         'HTTP_USER_AGENT' => 'Mozilla/5.0 iPhone',
     ]))->getData(true);
 
@@ -169,11 +176,32 @@ test('navigator controller returns missing organization error when no admin comp
     $controller            = new FleetOpsNavigatorControllerProbe();
     $controller->adminUser = fleetopsNavigatorUser(null);
 
-    $response = $controller->linkApp(new Request());
+    $response = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery()));
 
     expect($response->getData(true))->toBe(['error' => 'Organization for linking not found.']);
 });
 
+test('navigator controller refuses unsigned, tampered and expired app links before touching credentials', function () {
+    $company                   = fleetopsNavigatorCompany();
+    $controller                = new FleetOpsNavigatorControllerProbe();
+    $controller->adminUser     = fleetopsNavigatorUser($company);
+    $controller->apiCredential = fleetopsNavigatorCredential('flb_live_navigator');
+
+    $expired  = time() - 60;
+    $requests = [
+        'unsigned' => Request::create('/navigator/link-app', 'GET'),
+        'tampered' => Request::create('/navigator/link-app', 'GET', ['signature' => 'forged'] + fleetopsNavigatorSignedQuery()),
+        'expired'  => Request::create('/navigator/link-app', 'GET', ['expires' => $expired, 'signature' => NavigatorController::linkSignature($expired)]),
+    ];
+
+    foreach ($requests as $request) {
+        $response = $controller->linkApp($request);
+        expect($response->getData(true))->toBe(['error' => 'This Navigator link is invalid or has expired. Generate a new one from the console.']);
+    }
+
+    expect($controller->credentialLookups)->toBe([]);
+});
+
 test('navigator controller exposes link url settings and current organization token lookup branches', function () {
     $controller                = new FleetOpsNavigatorControllerProbe();
     $controller->apiCredential = fleetopsNavigatorCredential('flb_test_key');
@@ -194,7 +222,11 @@ test('navigator controller exposes link url settings and current organization to
     ]);
     $missing = $controller->getCurrentOrganization($secretRequest);
 
-    expect($linkUrl)->toBe(['linkUrl' => 'http://localhost/int/v1/fleet-ops/navigator/link-app'])
+    parse_str((string) parse_url($linkUrl['linkUrl'], PHP_URL_QUERY), $linkQuery);
+
+    expect($linkUrl['linkUrl'])->toStartWith('http://localhost/int/v1/fleet-ops/navigator/link-app?')
+        ->and($linkQuery['signature'])->toBe(NavigatorController::linkSignature((int) $linkQuery['expires']))
+        ->and((int) $linkQuery['expires'])->toBeGreaterThan(time())
         ->and($settings)->toBe(['enabled' => true, 'invite_code_required' => false])
         ->and($organization)->toBeInstanceOf(Organization::class)
         ->and($controller->credentialLookups)->toContain(

package/server/tests/NotificationAndMailContractsTest.php

@@ -675,3 +675,34 @@ test('maintenance schedule reminder mail exposes schedule context', function ()
             'offsetDays' => 7,
         ]);
 });
+
+test('customer credentials mail reads the portal slug from the customer company regardless of session', function (?string $sessionCompany) {
+    app('config')->set('fleetbase.console.host', 'console.fleetbase.test');
+    app('config')->set('fleetbase.console.secure', true);
+    app('config')->set('fleetbase.console.subdomain', null);
+    app('session.store')->put('company', $sessionCompany);
+
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    $connection->getSchemaBuilder()->create('settings', function ($blueprint) {
+        $blueprint->increments('id');
+        $blueprint->string('key')->nullable();
+        $blueprint->text('value')->nullable();
+        $blueprint->timestamps();
+    });
+    $connection->table('settings')->insert([
+        ['key' => 'company.company-portal.customer-portal-config', 'value' => json_encode(['accessUrlSlug' => 'acme-portal'])],
+        ['key' => 'company.other-company.customer-portal-config', 'value' => json_encode(['accessUrlSlug' => 'other-portal'])],
+    ]);
+
+    $customer              = new FleetOpsNotificationContactFake();
+    $customer->userForTest = new User();
+    $customer->userForTest->setRawAttributes(['email' => 'customer@example.test'], true);
+    $customer->setRawAttributes(['company_uuid' => 'company-portal'], true);
+
+    $content = fleetOpsNotificationWithEnvironment(fn () => (new CustomerCredentialsMail('plain-secret', $customer))->content());
+
+    expect($content->with['customerPortalUrl'])->toBe('https://console.fleetbase.test/acme-portal');
+})->with([null, 'other-company']);

package/server/tests/ObserverContractsTest.php

@@ -454,7 +454,7 @@ class FleetOpsNotifyDriverOnShiftChangeProbe extends NotifyDriverOnShiftChange
         return $this->schedule;
     }
 
-    protected function getSchedulingSettings(): array
+    protected function getSchedulingSettings(?string $companyUuid): array
     {
         return $this->settings;
     }

package/server/tests/OrchestratorConsumableApiTest.php

@@ -2,6 +2,8 @@
 
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\OrchestrationController;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Illuminate\Http\Request;
 
 function sanitize_orchestrator_payload(array $payload): array
 {
@@ -72,3 +74,43 @@ test('consumable orchestrator routes are registered under the public api group',
     expect($routes)->toContain("\$router->post('run', 'OrchestrationController@run');");
     expect($routes)->toContain("\$router->post('commit', 'OrchestrationController@commit');");
 });
+
+test('public orchestration uses API authentication without inheriting console IAM middleware', function () {
+    $registry = new OrchestrationEngineRegistry();
+    $public   = new OrchestrationController($registry);
+    $internal = new Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrchestrationController($registry);
+
+    expect($public->getMiddleware())->toBe([]);
+
+    // An API-key request has no console IAM role. The internal workbench must
+    // still refuse this actor; its middleware must not leak onto the API class.
+    app('session.store')->flush();
+    $request = Request::create('/int/v1/fleet-ops/orchestrator/run', 'POST');
+    app()->instance('request', $request);
+    foreach (['run', 'commit'] as $method) {
+        $guard = collect($internal->getMiddleware())->first(fn ($entry) => in_array($method, $entry['options']['only'], true));
+        expect($guard)->not->toBeNull();
+
+        try {
+            $guard['middleware']($request, fn () => throw new RuntimeException('Unauthorized request reached the workbench'));
+            test()->fail('The internal workbench must require a permitted user');
+        } catch (HttpResponseException $error) {
+            expect($error->getResponse()->getStatusCode())->toBe(401);
+        }
+    }
+});
+
+test('public orchestration resolves tenant scope from the authenticated session, never request input', function () {
+    $controller = new OrchestrationController(new OrchestrationEngineRegistry());
+    $company    = new ReflectionMethod($controller, 'companyUuid');
+    $company->setAccessible(true);
+    $request = Request::create('/v1/orchestrator/run', 'POST', ['company_uuid' => 'other-company']);
+    app()->instance('request', $request);
+
+    session(['company' => 'credential-company']);
+    expect($company->invoke($controller))->toBe('credential-company');
+
+    session(['company' => 'next-credential-company']);
+    expect($company->invoke($controller))->toBe('next-credential-company');
+    app('session.store')->flush();
+});